VULNERABILITY INTELLIGENCE

CVE-2014-9710

CVSS score6.9 MEDIUM
EPSS probability0.28%
CISA KEVNot currently listed
Published2015-05-27
Last modified2026-06-17
CVSS vectorAV:L/AC:M/Au:N/C:C/I:C/A:C

Description

The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit.

Weakness classification

  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Primary references